Audit Working Papers: What Good Documentation Must Prove

Make the audit logic visible

A working paper is more than a file of screenshots. It connects the question being tested, the work actually performed, the evidence obtained and the conclusion reached. A reviewer should be able to understand that chain without relying only on the preparer's memory.

1. Purpose and criteria

State the risk, objective, scope, period and expected condition. Identify the policy, agreement or other criterion used. Without that anchor, an exception may be described without showing why it matters.

2. Work performed

Describe the population, selection method, procedures and timing. Record what was actually done, including departures from the planned procedure. For analytics, identify the data boundaries, query version and checks on the logic. “Tested” is not a substitute for the method.

3. Traceable evidence

Link results to identifiable source records and explain how they support the test. Preserve relevant context and distinguish source evidence from the auditor's annotations. A screenshot without a source, date or explanation can be difficult to interpret. Apply approved access and retention controls to sensitive evidence.

4. Evaluation and limitations

Record exceptions, explanations tested, contradictory information and unresolved matters. Show the reasoning between the evidence and the conclusion. If the selected items or available information limit inference, say so. More attachments do not automatically strengthen the evidence.

5. Conclusion and review trail

Answer the objective within the actual coverage. Identify the preparer, reviewer, review actions and resolution of comments under the function's approved methodology, including its required supervisory and chief audit executive review and approval governance. A review tick does not replace the supporting analysis, and later changes should remain traceable under approved document controls.

In a hypothetical approval test, finding a signature is only part of the record. The paper may also need to establish the approver's authority, when approval occurred, what was approved and how exceptions were evaluated. The conclusion should follow that evidence, not the mere presence of a tick mark.

IIA Standard 14.6 connects engagement results with documentation, review and governed retention. This five-part anatomy is an original practical aid; it is not an official IIA template or a guarantee of conformance. The function's approved methodology and applicable requirements determine the complete record.

Beyond the numbers. Inside the business.